1. Who we are
Lotus River AI, Singapore UEN 53505110K (“Lotus River AI”, “we”, “us” or “our”), is responsible for personal data described in this policy. Our registered address and contact details are on the Contact page.
2. Personal data we collect
Depending on how you interact with us, we may collect:
- identity and contact details, such as your name, role, organisation, email address, telephone number and billing address;
- order and transaction information, including the service purchased, amount, currency, payment status and transaction reference;
- business process information you provide in questionnaires, calls, emails or documents;
- communications, support requests, scheduling details and feedback;
- basic technical information, such as IP address, browser type, device type and website access logs, where our hosting provider makes this available; and
- marketing preferences and consent records.
Payment card details are entered directly with our payment processor. We do not receive or store your complete card number or card security code.
3. How we collect personal data
We collect data directly from you when you contact us, place an order, complete a questionnaire, attend a meeting or request support. We may also receive limited payment and fraud-prevention information from our payment processor, and technical information from our website or hosting providers.
4. Why we use personal data
We use personal data to:
- respond to enquiries and provide requested information;
- process orders, confirm payments and deliver services;
- schedule consultations, prepare recommendations and provide customer support;
- maintain accounting, tax, audit and transaction records;
- protect our website, customers and business against fraud, misuse and security threats;
- comply with legal, regulatory and payment-network obligations;
- improve our services using aggregated or de-identified information; and
- send marketing only where you have consented or where otherwise permitted by law, with an unsubscribe option.
5. Consent and other permitted uses
Where Singapore’s Personal Data Protection Act 2012 (“PDPA”) requires consent, we will obtain it and allow you to withdraw it, subject to legal or contractual consequences we explain to you. We may also collect, use or disclose data without consent where the PDPA or another law permits or requires it, including where reasonably necessary to perform a contract, protect legitimate interests, respond to an emergency or comply with law.
6. Sharing and processors
We may share relevant data with service providers that help us operate, including payment processors such as Airwallex, website hosting providers, email and cloud storage providers, video meeting and scheduling providers, accountants and professional advisers. These providers may process data only for the relevant service and under appropriate protections. We may also disclose data where required by law, a court, regulator or payment-network rule, or in connection with a business reorganisation.
7. International transfers
Some providers may process data outside Singapore. Where the PDPA applies, we take reasonable steps to ensure transferred personal data receives a standard of protection comparable to that under the PDPA, including through contractual protections and reasonable provider checks.
8. Retention
We retain personal data only while it remains reasonably necessary for the purpose collected or for legal and business recordkeeping. Transaction and accounting records may be retained for the period required by Singapore law. Project working material is reviewed after completion and deleted or de-identified when no longer needed, unless a dispute, legal hold or continuing customer relationship requires longer retention.
9. Security
We use reasonable administrative, technical and organisational safeguards appropriate to the nature of the data. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. Please do not send passwords, full payment-card data or unnecessary sensitive personal data by email.
10. Your choices and rights
Subject to the PDPA and applicable exceptions, you may request access to personal data we hold about you, request correction of inaccurate data, or withdraw consent for future use. You may also ask a question or make a privacy complaint. We may need to verify your identity and may charge a reasonable fee for an access request where legally permitted, after notifying you in advance.
11. Cookies and links
This static website does not intentionally set advertising cookies. Our hosting or security providers may process basic technical logs. If we later add analytics, marketing cookies or embedded tools, we will update this policy and provide any consent mechanism required by law. Links to third-party websites are governed by those parties’ privacy practices.
12. Children
Our services are intended for businesses and adults acting for businesses. We do not knowingly collect personal data from children. If you believe a child has provided data to us, contact us so we can investigate and delete it where appropriate.
13. Contact and complaints
Email privacy questions or requests to hello@lotusriverai.com, marked “Privacy request”. Data protection contact: Craig Daniels, Owner. Our postal address is on the Contact page.
14. Changes
We may update this policy when our practices or legal obligations change. We will post the revised policy here and update the effective date.